Going against the grain

This article explores a few modern IT practices from a more skeptical point of view. Rather than assuming every new approach is automatically better, it looks at the tradeoffs around identity, encryption, password storage, and cloud platforms.

Local account vs Microsoft account sign in

Every new Microsoft OS revision, Microsoft makes it harder and harder for people to use local accounts to sign into Windows.

Using a Microsoft account has many benefits but essentially means that your OS is linked directly to your personal identity rather than a machine that can be used anonymously at least on a fundamental OS level.

It’s a similar argument if you think you should be able to use your car without signing into a car manufacturer’s login screen linked to online authentication instead of just using a traditional local key.

See the below pros and cons of using a local account vs Microsoft account. This is from a home user perspective but could be a very similar argument for on prem AD vs AzureAD.

Local account pros

• Sign in activity is not being monitored by Microsoft.
• If you do not sign into Microsoft services then there is no way for Microsoft to link you to your OS.
• You do not need the internet to sign into your machine.
• If you need to give your computer password to someone you are not giving your Microsoft account password at the same time.

Microsoft account sign in pros

• Password can be reset via internet rather than just locally.
• You can remotely manage aspects of your machine.
• You can upload your BitLocker key to the cloud for easy reference.

Local drive encryption

Previously when a critical component failed and your HDD or SDD survived you could easily retrieve your data by simply copying the files to another machine. With the introduction of BitLocker drive encryption this is no longer the case.

Now this doesn’t matter if you have the BitLocker decryption key and it is sync’d to your Microsoft account, which is recommended by Microsoft. But in the real world, things that sound easy and simple are rarely so. In the real world for one reason or another you might not have this decryption key and even though you physically have the drive your data is lost.

The question you have to ask yourself is whether the security is worth not being able to have your data easily accessible if you physically have access to the drive. Local drive encryption stops someone from accessing the drive data if they physically have it in their hand, not if it is stolen digitally from a breach.

So, you as an individual or business need to weigh up the risk vs reward.

Not encrypting risk

• Risk of physical theft: the thief sells the stolen machine and the drive is wiped. High risk.
• Risk of physical theft: the thief breaches normal Windows password security and maliciously uses the data to commit fraud. Low risk.

Encrypting risk

• The machine suffers a technical issue and the data needs to be retrieved but the BitLocker key is lost. High risk.
• The user accidentally physically damages the machine and the data needs to be retrieved but the BitLocker key is lost. High risk.

Another way to phrase it is how often data breaches are caused by a physically stolen or misplaced drive vs how many come from digital data breaches. I argue that it’s a 10 to 1 ratio. While the risk that something accidentally happens to your machine and you need to retrieve data but do not have a decryption key is much more likely in the real world.

Is data security so important for your business or required for regulatory reasons that the risk of losing data is worth the extra operational hindrance that local drive encryption introduces? This is a non-debate for sensitive industries such as defense, finance, health, or if you have state secrets, but the same universally isn’t true for a vast number of individuals and businesses.

The argument for writing down passwords on a physical piece of paper

Do not write your password on a piece of paper, only use a password safe.

This has been a universal rule in IT since the dawn of time: do not write credentials on physical paper.

But I have a question for you. What is more likely to happen these days: someone stealing your personal information digitally stored in the cloud via an IT security breach, or someone breaking into your house to steal your physical birth certificate?

In this modern age it’s no longer a crazy question to ask what is more secure: something that is stored digitally or a piece of paper in your bottom drawer. Something that can theoretically be hacked or compromised, or a random piece of paper in your home office buried in other equally sensitive documents such as your birth certificate?

One you have no control over and the other is a location that someone would have to physically find. The question might be easy if you are a spy or have state secrets where bad actors will plan a sophisticated heist on your home or business. But the long-recognized best practice approach to not write the credentials on a piece of paper but to store them digitally is arguably not the most secure approach in a totally digital world.

Now I am not advocating for passwords to be kept on a piece of paper directly in front of your machine, but even then, realistically ask yourself in modern times what is truly more at risk: your home office desk or a password stored digitally that one way or another can be compromised.

At least one option requires physical real-world access to your property.

Now even with this new logic it is never a good idea to write down really sensitive passwords like your internet banking or main computer password on paper easily accessible in your house, but we also wouldn’t recommend keeping things like that stored in your browser either.

We really just need a common-sense approach rather than just an inflexible statement advising not to write passwords on paper physically. In some ways physically storing the password on paper could be more secure in many ways.

The argument against migrating all data to cloud platforms

Using OneDrive and SharePoint is convenient and has quickly become the industry standard for storing business files as it offers flexible connectivity that is not dependent on a single physical resource that could fail. But the flip side is that you lose control and sovereignty of your data. Some negatives include:

• If you do not have a local cache of the data and the internet or the service itself experiences any issues then you will be unable to access your data. If global conflict breaks out you could lose access.
• Whatever the provider says, they physically have your data and it is possible for them to use that data for their own uses, for example to train AI models.
• Data stored overseas may be subject to international jurisdictions, causing you to lose your data sovereignty.
• The cost to host this data could increase throughout time and there is a possibility of becoming trapped in the platform or ecosystem and having no choice but to pay ever increasing higher prices.